Web Application Penetration
- 1. Web Application Penetration 1 Pr. Saeed Alam
- 3. 3 Topics • What is Security • What is computer security • Web application security • OWASP • OWASP Top ten vulnerability • React Vulnerability
- 4. 4 What is Security ?
- 5. 5 What is Security Security is freedom from, or resilience against, potential harm (or other unwanted coercive change) caused by others
- 6. 6 What is Computer Security ?
- 7. 7 What is Computer Security Computer security, cybersecurity or information technology security (IT security) is the protection of computer systems from theft or damage to their hardware, software or electronic data, as well as from disruption or misdirection of the services they provide.
- 9. 9 Web application security Web application security is a branch of information security that deals specifically with security of websites, web applications and web services. At a high level, web application security draws on the principles of application security but applies them specifically to internet and web systems.
- 11. 11 OWASP
- 12. 12 OWASP
- 13. 13 OWASP Top Ten Vulnerability 1-injection
- 14. 14 OWASP Top Ten Vulnerability 1-Injection
- 15. 15 OWASP Top Ten Vulnerability 1-Injection
- 16. 16 OWASP Top Ten Vulnerability 1-Injection
- 17. 17 OWASP Top Ten Vulnerability 2-Broken Authentication
- 18. 18 OWASP Top Ten Vulnerability 2-Broken Authentication
- 19. 19 OWASP Top Ten Vulnerability 2-Broken Authentication
- 20. 20 OWASP Top Ten Vulnerability 2-Broken Authentication
- 21. 21 OWASP Top Ten Vulnerability 3-Sensitive Data Exposure
- 22. 22 OWASP Top Ten Vulnerability 3-Sensitive Data Exposure
- 23. 23 OWASP Top Ten Vulnerability 3-Sensitive Data Exposure
- 24. 24 OWASP Top Ten Vulnerability 4-XML External Entities
- 25. 25 OWASP Top Ten Vulnerability 4-XML External Entities
- 26. 26 OWASP Top Ten Vulnerability 4-XML External Entities
- 27. 27 OWASP Top Ten Vulnerability 4-XML External Entities
- 28. 28 OWASP Top Ten Vulnerability 5-Broken Access Control
- 29. 29 OWASP Top Ten Vulnerability 5-Broken Access Control
- 30. 30 OWASP Top Ten Vulnerability 5-Broken Access Control
- 31. 31 OWASP Top Ten Vulnerability 5-Broken Access Control
- 32. 32 OWASP Top Ten Vulnerability 6-Security Misconfiguration
- 33. 33 OWASP Top Ten Vulnerability 6-Security Misconfiguration
- 34. 34 OWASP Top Ten Vulnerability 6-Security Misconfiguration
- 35. 35 OWASP Top Ten Vulnerability 7-Cross Site Scripting(XSS)
- 36. 36 OWASP Top Ten Vulnerability 7-Cross Site Scripting(XSS)
- 37. 37 OWASP Top Ten Vulnerability 7-Cross Site Scripting(XSS)
- 38. 38 OWASP Top Ten Vulnerability 7-Cross Site Scripting(XSS)
- 39. 39 OWASP Top Ten Vulnerability 8-Insecure Deserialization
- 40. 40 OWASP Top Ten Vulnerability 8-Insecure Deserialization
- 41. 41 OWASP Top Ten Vulnerability 8-Insecure Deserialization
- 42. 42 OWASP Top Ten Vulnerability 9-Using Components with Known Vulnerabilities
- 43. 43 OWASP Top Ten Vulnerability 9-Using Components with Known Vulnerabilities
- 44. 44 OWASP Top Ten Vulnerability 9-Using Components with Known Vulnerabilities
- 45. 45 OWASP Top Ten Vulnerability 10-Insufficient Logging&Monitoring
- 46. 46 OWASP Top Ten Vulnerability 10-Insufficient Logging&Monitoring
- 47. 47 OWASP Top Ten Vulnerability 10-Insufficient Logging&Monitoring
- 49. 49 React Vulnerability ReactJS is quite safe by design since ● String variables in views are escaped automatically ● With JSX you pass a function as the event handler, rather than a string that can contain malicious code But …
- 51. 51 React Vulnerability XSS via dangerouslySetInnerHTML
- 52. 52 React Vulnerability XSS via a.href attribute
- 53. 53 React Vulnerability XSS via a.href(base64 encoded data)
- 54. 54 React Vulnerability XSS via attacker controlled props
- 55. 55 Any Question?
- 56. 56 Resources ● owasp ● slideshare.net/kseniadmitrieva ● stackoverflow.com/questions/33644499/